The issue allows remote attackers to obtain sensitive information via unspecified vectors. This occurs when cURL and libcurl send the HTTP Basic authentication credentials for a previous connection when reusing a reset connection handle to send a request to the same host name. libcurl can wrongly send HTTP credentials when re-using connections, specifically when using the `curl easy reset()` function, which is supposed to clear the credentials but does not. This can lead to credentials being leaked in subsequent requests to the same hostname.